Does Surviving Review Prove an Algorithm Is Safe
Time in public review is weak evidence that a cryptographic algorithm is secure, and it is routinely offered as strong evidence. The claim I want to defend is narrow and specific: “it has been studied for years and nobody has broken it” establishes only that nobody has published a break, which is a statement about the state of the literature rather than a statement about the algorithm. Two documented cases inside the post-quantum standardization process show the gap directly.
SIKE was studied for roughly 10 years, advanced through a rigorous adversarial international competition, and was then broken classically in about 10 minutes on a single processor core. HAWK was withdrawn by its own submission team 1 day after an attack surfaced that years of expert analysis had not found. Both went from trusted to dead inside a news cycle, and in each case the expectation had been slow erosion of the security margin rather than total key recovery.
The short version:
- Review duration is the most-cited justification for confidence in a cryptosystem, and it is the weakest one available. It measures how much attention a scheme has received rather than how much attack it can withstand.
- SIKE is the strongest counterexample. Roughly 10 years of study, deep into NIST Round 4 as an alternate, broken by a classical polynomial-time attack that needed no quantum hardware and no cluster.
- HAWK is the second, and it is 4 years more recent. An improved key-recovery attack was posted on 28 July 2026 and the submission team withdrew the scheme on 29 July 2026.
- Both breaks were sudden rather than gradual. The expectation in both cases was slow erosion of the security margin, and what actually happened was total key recovery.
- My read, offered as a read: the field treats both as evidence that the process worked, and that framing is true about the process while being the wrong lesson about the algorithms. The competition caught them because they were inside a competition.
- This is not an argument that the finalized standards are unsafe, and it is not an argument to slow the migration. It is an argument about what justifies confidence, and about why hedging across several unrelated families of mathematics is a structural response rather than a cautious one.
What does “studied for years” actually establish?
It establishes that a number of people looked, for a period of time, and did not publish a break. Every term in that sentence is doing less work than it appears to.
The number of people is unknown and usually small. Serious cryptanalysis of a specific scheme is done by a handful of specialists worldwide who have the relevant mathematical background, and their attention is finite and follows fashion. The period of time is real but says nothing about intensity. And “did not publish a break” is the crucial one: it is a negative result about the public literature, and negative results in cryptanalysis are not evidence of absence in the way they are in other empirical fields, because a break is a construction rather than a measurement. Nobody has demonstrated that the construction cannot exist. They have demonstrated that they have not found it.
That distinction is ordinary and uncontroversial among cryptographers. What I am arguing is that it disappears the moment the claim leaves the technical literature and enters procurement documents, vendor material, and board briefings, where “extensively reviewed” is presented as though it were a measured property of the algorithm.
What did SIKE actually demonstrate?
SIKE was a key encapsulation mechanism built on the Supersingular Isogeny Diffie-Hellman construction, and its appeal was size. Its public keys and ciphertexts were dramatically smaller than the lattice-based alternatives, which made it the standout candidate for constrained environments. It had been studied for roughly 10 years and NIST retained it as an alternate candidate in Round 4 for continued study rather than eliminating it.
Source: NIST, “Status Report on the Third Round of the NIST Post-Quantum Cryptography Standardization Process,” NIST IR 8413, July 2022, csrc.nist.gov/pubs/ir/8413/upd1/final.
In July 2022, Wouter Castryck and Thomas Decru published a classical, polynomial-time key-recovery attack exploiting the torsion-point images that SIDH publishes as part of its exchange, using higher-dimensional tools in the lineage of Kani’s reducibility criterion.
| SIKE parameter set | Claimed security level | Recovered classically on one core in |
|---|---|---|
| SIKEp217 (challenge instance) | challenge | under 5 minutes |
| SIKEp434 | NIST level 1 | about 10 minutes |
| SIKEp751 | NIST level 5 | about 3 hours 15 minutes |
Source: Castryck & Decru, “An Efficient Key Recovery Attack on SIDH,” IACR ePrint 2022/975, July 2022, eprint.iacr.org/2022/975.
The level 5 parameter set is the one intended to stand against the most capable adversary the classification scheme contemplates. It fell in about 3 hours 15 minutes, on a single processor core, using no specialized hardware.
The part that matters for this argument is not the speed. It is the visibility. SIKE was not obscure. The torsion-point images had been discussed as a potential soft spot for years. The flaw was sitting in the open, in a well-known scheme, inside an adversarial competition, and the decade of review did not surface it. What surfaced it was the arrival of a piece of mathematics from an adjacent area.
Was HAWK the same pattern?
HAWK was a signature candidate in NIST’s additional-signatures process. On 28 July 2026 an improved key-recovery attack was posted to the public pqc-forum mailing list, reducing HAWK-n key recovery to a shortest-vector problem in dimension n/2 + 1. The submission team withdrew the scheme on 29 July 2026, and NIST’s Round 3 project page records the withdrawal.
The attack’s underlying discovery is credited to an AI model that identified a nontrivial automorphism in the lattice HAWK rests on, and the practical effect is a halving of the effective key size, so preserving the original security claim would require doubling the key and surrendering the compactness that was the scheme’s reason to exist.
Two features of the HAWK case sharpen the argument beyond what SIKE alone supports. The first is speed of collapse: 1 day from posted attack to withdrawal, with independent confirmation inside hours. The second is the source. The property that broke HAWK had not been found by the human specialists who had been looking, which means the pool of available cryptanalytic attention just changed size in a way that no amount of prior review anticipated. Review duration accumulated under one set of conditions does not carry forward into a different one.
What does the strongest counterargument say?
The strongest objection is that both cases show the system working exactly as designed, and it is a good objection.
Standardization competitions exist to break candidates before they are deployed. SIKE and HAWK were both caught while still candidates. Neither appears in a finalized standard, neither shipped in a product, and no user of ML-KEM, ML-DSA or SLH-DSA was ever exposed. On that reading, the correct conclusion is confidence rather than alarm: the process catches things, and the surviving algorithms are the ones that survived it.
That reading is right about the process and I would not argue with any of it. Where I part company is what it licenses going forward.
Both schemes were caught because they were inside a competition, during the window when a global community had a specific reason to attack them and public credit for succeeding. That window closes. Once an algorithm is standardized and deployed, the incentive structure changes: cryptanalysis of a deployed standard is harder to publish, more consequential to claim, and in some jurisdictions attracts attention its author may not want. The finalized standards are now in the phase where they will accumulate deployment years rather than adversarial-competition years, and those are not the same currency. The argument “it survived the competition” is a claim about a period that has ended.
The counterargument is also right that the lattice assumptions underneath the finalized standards have a substantially longer and more intensively studied history than SIDH did, and I take that seriously. It is a genuine difference in kind, not a difference in marketing. It moves the probability. It does not convert review duration into proof.
Where does this argument stop holding?
Several places, and they matter.
It is not a claim that any finalized standard is broken or weak. No published attack threatens ML-KEM, ML-DSA or SLH-DSA, and nothing in this note should be read as suggesting otherwise. The HAWK attack’s own authors state it does not affect the other NIST post-quantum schemes.
It is not an argument to delay migration. The algorithms being replaced are the ones with a known break waiting on hardware. Preferring a documented future failure over an undocumented possible one is not caution.
It is not a claim that all review is equally weak evidence. Decades of concentrated attack on a problem that many independent schemes depend on is meaningfully stronger than a decade of attention on one construction. The gradient is real. My argument is that the gradient is a gradient, and it gets reported as a threshold.
And it does not extend to a prediction. I am not saying a standardized post-quantum algorithm will fall, and I would not put a date on it if I were. The claim is about the structure of the evidence, not about a forecast.
What follows from it?
The most useful consequence is that it explains a design decision that otherwise looks like indecision.
NIST standardized algorithms resting on unrelated mathematical foundations, and kept an additional-signatures process running after the first standards were finalized. Read as an efficiency problem, that looks like a failure to commit. Read against the SIKE and HAWK record, it is the only available structural hedge: if confidence in any single family is bounded by what the literature has happened to find, then the protection is not better confidence, it is having a second family whose failure would be uncorrelated with the first.
The same reasoning explains why concentration is a live concern in the current transition even though the transition is an improvement. Replacing several widely used algorithms with a smaller number of widely used algorithms narrows the number of independent assumptions the world’s confidentiality rests on, and the SIKE record is the reason that narrowing is worth naming rather than waving through.
How is this different from saying post-quantum cryptography is overhyped?
It is close enough to be worth separating, because the two arguments are often conflated and they point in opposite directions.
The overhyped position, taken seriously in Is the Quantum Threat Overhyped, holds that the threat is exaggerated and the response is disproportionate. This argument accepts the threat and the response, and questions one specific justification used inside the response. Someone who agreed with everything here would still migrate, on the same schedule, and would additionally care about which families they depend on and whether they could change one without rebuilding everything.
Common misconceptions
- “SIKE was broken by a quantum computer.” No quantum hardware was involved anywhere in the attack. It was classical, and it ran on an ordinary machine.
- “A NIST standard was broken.” Neither SIKE nor HAWK was ever standardized. Both were candidates, and both were removed before standardization.
- “The breaks mean isogeny cryptography is dead.” The SIKE attack exploited torsion-point images specific to the SIDH construction. Isogeny-based signatures like SQIsign do not expose them and remain under evaluation.
- “Post-quantum means proven secure against future attacks.” It means resistant to the quantum attacks currently known. It is a scope claim, not a permanence claim.
- “Longer review means the algorithm is stronger.” Longer review means more opportunity for someone to have published a break. It raises the cost of the remaining unknown, and it does not eliminate it.
Questions people ask
How long had SIKE been studied before it broke? Roughly 10 years, and it had advanced through multiple rounds of the NIST process as an alternate candidate retained for continued study.
How fast was the SIKE break, exactly? The NIST level 1 parameter set fell in about 10 minutes on a single core, and the level 5 set in about 3 hours 15 minutes, on ordinary hardware with nothing specialized involved.
Has a finalized post-quantum standard ever been broken? No. Every break in this record happened to a candidate during the standardization process, before finalization.
Does the HAWK case mean AI will break the standards? It means one AI system found a lattice property that human specialists analyzing the same scheme had not found, and that the pool of cryptanalytic attention is changing. It is not evidence about the finalized standards, whose authors state they are unaffected.
If review duration is weak evidence, what is stronger? Reduction proofs to well-studied problems, the breadth of independent schemes depending on the same assumption, the intensity rather than duration of attention, and the existence of an uncorrelated fallback. None of them is proof either, and the combination is what confidence rests on.
Should any of this change a migration plan? Not its timing. It bears on how much ability to change algorithms later is worth building in now, which is a question the record here informs and does not answer.
Why did NIST keep running a signatures process after standardizing signatures? To develop options resting on different mathematics from the ones already selected. The SIKE and HAWK record is the clearest available argument for why that is worth the effort.
Is this a reason to prefer symmetric cryptography where possible? Symmetric primitives face a different and much better understood quantum situation, which is a separate topic covered in Grover on AES. It is not a general substitute for public-key cryptography.
When your team needs to work out which cryptographic dependencies it can actually change later, that’s the work I do.
Last verified 2026-08-10 · Updated 2026-08-25 · Maintained by Addie LaMarr, LaMarr Labs.